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PRE-APPEAL BRIEF REQUEST FOR REVIEW AND STATEMENT OF REASONS 

Sir: 

Applicants request review of the Final Office Action dated September 2, 2009 in this 
application. No amendments are being filed with the request. This request is being filed with a 
Notice of Appeal. The following sets forth a succinct, concise, and focused set of arguments for 
which the review is being requested. 

CLAIM STATUS 

In the Final Office Action, claims 1-7, 11, and 13-19 were rejected as obvious over U.S. 
Patent No. 7,107,338 toNareddy and U.S. Publication No. 20020016771 to Carothers; and claims 
8-10, 12, and 20 were rejected as obvious over Nareddy, Carothers and U.S. Publication No. 
2004022131 1 to Dow et al. As explained below, Applicants respectfully traverse the rejections. 
A. Claims 1-20 Are Not Obvious Over the Cited Art References 
Claims 1-20 variously recite a method, article of manufacture, or system for grouping and 
processing log file entries using a memory window or ring buffer to select a "subset" of the log file 
entries, and then identifying log file entries in the subset that belong to a complete session. 1 In 



1 Claim 1 states that, after retrieving a " subset of log file entries from the memory," each entry is processed 
"to identify entries in the subset of log file entries that belong to a complete client session." Similarly, claim 
8 requires reading "a plurality of records. . . into a ring buffer, where said plurality or records comprises a 
subset of all records in the file system," scanning "each record in the ring buffer " to identify a user session, 
allocating an index "to identify all records in the ring buffer that are associated with the identified user 
session," and processing the index "to group all records in the ring buffer belonging to a complete user 
session."). Likewise, claim 1 1 recites a "processing engine to process a subset of the plurality of server 
request entries to group the server request entries by session using the session identifier in each server 
request entry" and claim 1 8 recites a means for "reading a subset of the network session data," "processing 
the subset of the network session data to group said network session data by session," and "generating a first 
output file containing network session data grouped by session ." 
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selected claims, complete user sessions from the log file entries are identified and grouped by 
processing only a subset of the log file entries at a time using a " sliding window " or " ring buffer " to 
read log files. See, claims 8-10, 12-13, and 18-20. By processing the "subset of log file entries" at 
any one time, only a portion of the log file is loaded into memory window to identify entries in the 
subset of log file entries that belong to a complete client session without reading all of the log file 
entries. Thus, each claim requires that a " subset of log file entries" (claim 1), "a plurality of records 
from a file system into a ring buffer, where said plurality or records comprises a subset of all 
records" (claim 8), "a subset of the plurality of server request entries" (claim 1 1), or " subset of the 
network session data" (claim 18) be processed to identify and group the entries/records/data from 
the subset by session. 

In response to the various rejections of claims 1-20 as being obvious, Applicants 
respectfully request reconsideration and withdrawal of the rejections because the cited art fails to 
disclose Applicants' scheme for retrieving and processing "a subset of log file entries" using a 
memory window to select a subset of the log file records for identifying complete session records 
that may be analyzed or parsed, and for otherwise identifying incomplete session records for 
subsequent processing. To the contrary, the cited art clearly and explicitly discloses processing "all 
log entries," one log entry at a time, and never discloses or suggests storing a subset of the log file 
entries (e.g., in a "sliding memory window" or "ring buffer") so that complete sessions in the subset 
of log file entries may be identified and grouped for 
processing without having to make a complete copy of 
the log file. Indeed, the very Nareddy passage (Nareddy 
col. 13, lines 10-60) cited to meet the requirement of 
"processing each entry in the memory to identify entries 
in the subset of log file entries that belong to a complete 
client session" ( Office Action , pp. 10-11) explicitly states 
that "[f]he routine processes each entry in the log file 
based on the parser configuration data." This is 
confirmed in the "Response to Arguments" section with 
the Examiner's assertion that "Nareddy teaches the 
routine process each entry in the log file based on the 

parser configuration data." Office Action , p. 3 (emphasis ; — * ^ 
in original). And as shown herein, the associated i 
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Nareddy drawing (Figure 5) also shows that "all log entries" are parsed, on log entry at a time. 

Indeed, once the flow diagram shown in Figure 5 and associated description at Nareddy col. 
13, lines 10-60 are properly understood to provide the overall organization for the remainder of 
Nareddy' s disclosure, it becomes clear that the other cited Nareddy passages do not meet the claim 
requirements. For example, Figure 5 shows that, for each log entry, a "generate dimensions 
routine" 507 is run to update the dimension tables, where Figure 8 shows that the "generate 
dimensions routine" includes the "identify page type" and "identify events" routines that are 
described and depicted with reference to Figures 1 1 and 23 ("Identify Page Type Routine") and 
Figures 12 and 24 ("Identify Events Routine"). To the extent that the rejection analysis relies on 
Nareddy' s description of Figure 23 at col. 49 (lines 33-58) to meet claim 1 's requirement of 
"retrieving a subset of log file entries from the memory," this reliance is clearly misplaced insofar 
as "identify page routine" is clearly being run on "all log entries," one log entry at a time. 

But an even more fundamental problem with Nareddy's disclosure is that the referenced 
"subset of the version groups" (col. 49, lines 33-58) cited in the rejection analysis ( Office Action , p. 
10) is referring to version groups for the "retrieved category type definition information," and in no 
way discloses or suggests "retrieving a subset of log file entries from the memory" as claimed. The 
presence of the word "subset" in the cited Nareddy passage (col. 49, lines 33-58) refers to "version 
groups," and simply does not meet the claim requirement of "retrieving a subset of log file entries 
from the memory" (claim 1), reading "a plurality of records from a file system into a ring buffer, 
where said plurality or records comprises a subset of all records in the file system" (claim 8), 
processing "a subset of the plurality of server request entries" (claim 1 1), or "processing the subset 
of the network session data to group said network session data by session" (claim 18). 

As seen from the foregoing, Nareddy is quite explicit that " all log entries " are processed by 
the Nareddy's "identify sessions routine," and there is no attempt made to separate out a "subset" of 
entries for processing to identify complete user sessions. Instead, Nareddy teaches that the identify 
sessions routine is only run after "all log entries" have already been parsed. See, Nareddy's Figures 
5 and 13 and col. 16, line 47-col. 17, line 3. Nothing in Carothers or Dow overcomes this 
deficiency. Indeed, the cited art combination merely typifies conventional approaches for 
processing all of the log entries to extract session data, such as described and distinguished by 
Applicants in the Background of Invention section. See, Application, paragraph 14 ("For large log 
files that are larger than the amount of available random access memory ("RAM"), the grouping of 
log file entries by session can use a lot of computational resources. For example, conventional 
grouping techniques involve reading the log file, request-by-request, and sorting the requests into a 
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new file, set of files, database, or index on the file system that is structured to make locating 

requests in the same session fast. For example, the log files could be imported into a table in a 

database where each line in the log file is imported as a single record in the database, and where one 

of the fields in the database record identifies the session the request belongs to. With this 

arrangement, standard database techniques can be used to sort the table by the session field and then 

read the records out of the database in session field order. However, this technique requires 

creating an extra copy of the log file and also significant processing speed penalties in the time 

required for extracting data from the log files for storage in a database."). 

The foregoing deficiencies with respect to the independent claims are sufficient to overcome 

the cited art references. However, the deficiencies in the dependent claim analysis are even more 

glaring. For example, claim 10 recites that "the ring buffer implements a sliding window to process 

all of the log records in the file system into complete user sessions by sequentially adding and 

removing log records to the ring buffer until all of the log records in the file system have been 

processed." To meet this claim requirement, the rejection analysis cites Narcddy's disclosure (col. 

21, lines 30-40) of a web browser display window 1970 shown in Figure 19U and Dow's teaching 

of an "event buffer module." See, Office Action , p. 32. With all due respect, Applicants submit 

that the cited Narcddy disclosure nowhere discloses or suggests the claim requirements for 

implementing a sliding window to process all of the log records in the file system into complete 

user sessions, as readily seen from the cited passage set forth below: 

In the illustrated embodiment, a user digimineqa from the Quality Assurance department of 
digiMine provides the appropriate access information on the web page illustrated in FIG. 
19T and, after interacting with the web site by selecting the "submit" button, receives the 
web page 1972 illustrated in FIG. 19U. This web page is shown displayed within a web 
browser display window 1970. The displayed web page includes multiple frames that are 
each able to display different content, including a control frame 1979 with various user- 
selectable controls 1977 and display frames 1975 in which customer-specific information is 
displayed. In the illustrated embodiment, the URL indication 1920 corresponds to the 
information displayed in the display frames. The path portion of the indicated URL specifies 
an executable Active Server Page ("ASP") program on the server that will supply the content 
displayed in the display frames, and the indicated URL also includes a query string portion 
that will be supplied as input to the executable program. 

Nareddy, col. 21, lines 30-40. The cited Nareddy disclosure appears to be wholly disconnected 

from the claim requirements, and there is nothing in Dow to remedy this deficiency. The same 

deficiency applies to the rejection analysis for claims 13 and 19. 

In view of the failure to establish a prima facie case of obviousness over Nareddy and 

Carothers (alone or in combination with Dow) such as explained above, Applicants respectfully 
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submit that the Examiner has incorrectly applied the legal requirements for establishing 
obviousness. To establish prima facie obviousness of a claimed invention, all the claim limitations 
must be taught or suggested by the prior art. In re Rovka . 490 F.2d 981, 180 USPQ 580 (CCPA 
1974); In re Wilson , 424 F.2d 1382, 1385, 165 USPQ 494, 496 (CCPA 1970). This has not been 
done. At best, the cited combination of references discloses grouping transactions by transaction. 
There is no disclosure or suggestion in Naredddy and Carothers or Dow of using a session-based 
scheme for grouping and processing log file entries using a memory window to select a subset of 
the log file records, and then process the subset records to identify or group the subset records by 
session. Accordingly, Applicants respectfully request that the obviousness rejection of claims 1-20 
be withdrawn and that the claims be allowed. 

CONCLUSION 

For at least the foregoing reasons, Applicants submit that the rejection of the pending claims 
should be removed and these claims should be allowed. Nonetheless, should any issues remain that 
might be subject to resolution through a telephonic interview, the Examiner is requested to 
telephone the undersigned at (512) 338-9100. 



II l( ATI Ol TRANSMISSION 



Respectfully submitted, 

/Michael Rocco Cannatti/ 

Michael Rocco Cannatti 
Attorney for Applicants 
Reg. No. 34,791 
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